I have an application that uses an OAUTH2 flow based on JWT and JWKS.

JWT and JWKS are used for the "client authentication": when the application needs to call the endpoint to flip the authorization code to an access token, instead of using a shared secret, it uses a signed JWT. The authentication service will call the JWKS endpoint implemented by the application to retrieve the public key and validate the JWT.

Given that I have already all of this in place, I am wondering if I can use the same mechanism to authenticate server to server calls.

The idea is that the authorization service can expose an endpoint that will return an access token for the application itself instead of an actual user (I can configure a service account that will get authenticated when using this flow).

This means that the first steps of the OAUTH2 flow, where the user is authenticated, are not necessary. The authorization service will only authenticate the client - validating the signed JWT sent by the client application - and generate an access token for a predefined service account.

Do you see any problems with this?

  • 1
    That's what client credentials flow is used for.
    – defalt
    Commented Jan 18, 2023 at 12:20
  • I wasn't sure that client credentials could be used with JWTs and JWKs as well Commented Jan 19, 2023 at 11:28

1 Answer 1


I do not know if it would be better to cancel this question, but just in case someone else is looking for the same solution, the answer is that there is already a well defined flow with grant_type equals to client_credentials that works exactly as described in my question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .